2026-09-03T0410Z-intel

Verification & coverage notes

Runaway-duration warning (duration_seconds=11672, ~3.2 h): not a stall. The verification loop ran the full 8-iteration cap: seven consecutive NEEDS_FIXES verdicts, each with genuine truth/editorial findings requiring remediation and a fresh cold re-spawn (per decision rules 3-4, F1/F4 or truth+editorial ≥ 3 on every iteration through iteration 7), reaching the cap without a confirmed CLEAN. No sub-agent exceeded its per-role hard cap (45 min research / 30 min verification) and none was abandoned; the total reflects nine new entries plus two changelog updates across eight full verifier passes, not a hang.

Declined verifier findings (iteration 5), with rebuttal:

• F16 (SonicWall SMA1000 priority): the verifier flagged, at low confidence and explicitly advisory ("flagging for the main agent to weigh, not asserting the calibration is wrong"), that priority: high reads close to the critical bar given the zero-day/pre-auth/vendor-confirmed-exploitation profile. Declined: this store's existing 2026-07-14 SonicWall SMA1000 entry (CVE-2026-15409/15410) carries a near-identical profile, pre-auth SSRF chained to command injection, vendor-confirmed active exploitation, later ransomware-affiliate abuse, at priority: high, not critical. Upgrading this entry alone would create an unexplained inconsistency between two entries covering the same product line and vulnerability class three months apart; high is kept for consistency with that precedent rather than re-derived from the bar in isolation.
• F11 (run-record language): the verifier flagged this section's use of "sub-agent" and "S3 finding" as workflow- internal language under the hard no-internal-language rule. Declined: that rule's own text scopes explicitly to entry fields, title, headline, summary, sourcing_note, body, changelog sections (prompts/cti-run.md § Style rules), and tools/check_run.py's own reader-text-internals check enforces it only against those entry fields, never against run records. The run record is the operational/audit artifact this same prompt section explicitly authorises to carry "phase names, gate/verifier mechanics", the S1-S4 sub-agent domain labels are load-bearing shorthand here, not a defect to scrub.

Declined verifier findings (iteration 8), with rebuttal:

• F11 (run-record historical tallies): the verifier flagged, at low confidence and explicitly advisory, that iterations 1 and 3's recorded truth/editorial counts in verification.iterations[] don't sum to match the code-classification of their own listed findings (iterations 2 and 4-7 all check out exactly). Declined: per-iteration counts are recorded contemporaneously at the time each iteration completes and are audit-trail history, not currently-published claims, no entry, published fact, or reader-facing content is affected. Retroactively rewriting already-committed iteration 1/3 counts risks introducing its own transcription error for zero reader-facing benefit; the discrepancy is noted here transparently instead.

Coverage window: Standard (gap_hours 24.0, window_hours 26, no catch-up/major-gap disclosure required).

KEV mechanical sweep (v4.8 duty): tools/kev_window_diff.py --window-hours 26 found 7 in-window CISA KEV additions, 3 already covered (CVE-2026-82329 JFrog, CVE-2026-48710 Starlette, CVE-2026-49869 Kestra, logged, no action) and 4 NOT COVERED. All 4 received a disposition this run: CVE-2026-59822 (BerriAI LiteLLM), CVE-2026-83548/CVE-2026-83549 (SonicWall SMA1000) and CVE-2026-9586 (Sangoma Switchvox) each published as a new entry. No borderline-drops from this set.

Single-source items (standard, no carve-out): MoiClient (AhnLab ASEC only); Kimsuky Backblaze-B2 LNK campaign (AhnLab ASEC only); Teams helpdesk-impersonation/EtherRatz campaign (Microsoft only, no independent write-up of this specific 2026-09-02 publication located).

Reduced-confidence inclusion (PD-12): CVE-2026-0768 (Langflow renewed exploitation), both sources (BleepingComputer, heise) are news-aggregator hosts; VulnCheck's own commentary is LinkedIn-only and not citable as a URL. Included with reduced confidence (confidence: medium) per PD-12 rather than dropped, since the underlying CVE identity, exploitation timeline and technical detail are independently confirmed by NVD/ZDI/GitHub-Releases cross-checks in the Phase 2 spot-check.

Borderline drops:

• UK Supreme Court Shehabi v. Bahrain spyware-immunity ruling (S3 finding, flagged borderline by the sub-agent itself), no technical/TTP content for a highly technical SOC audience, no Swiss/EU nexus stated in any source; a foreign-jurisdiction legal precedent that does not change what a Tier 2/3 responder does in the next 7 days.
• Silver Fox counterfeit-installer brand-impersonation campaign (S3 finding), victims overwhelmingly China-based operations and Chinese-speaking users; the one transferable technique (server-side per-request hash regeneration defeating hash-based blocklisting) does not add a materially new detection concept beyond this store's existing malware-distribution coverage, and the campaign carries no home-region, coverage-focus or profiled-sector nexus.

Coverage backlog (state/coverage_backlog.md): two new open rows, suspected IDScan.net/Nexus driver's-license marketplace breach (153M+ documents, US/Canada; no source states an access vector or mechanism, so no incident entry can carry an evidence-bound ATT&CK mapping, same blocking condition as the standing Boston Scientific row); Kairos extortion group's claim against Ville de Libercourt, France (bare leak-site listing, no victim confirmation). Six existing open rows re-checked with dated notes, all "no change": the Zurich LockerGoga/MegaCortex/Nefilim verdict (not due until 2026-09-10), the Siemens S7 PDF re-read, CVE-2026-16242 (Red Hat OpenShift), the Boston Scientific incident, Ixa Systems SA/TheGentlemen, and UICC/Krybit. The inside-it.ch/Insel Gruppe row was re-checked and hit a new failure mode (whole-host HTTP 429, distinct from the prior paywall/403 conditions) rather than a resolution.

Coverage gaps: inside-it-ch (whole-host HTTP 429 on every transport this run, blocked both the Insel Gruppe backlog re-check and an unrelated Swiss Federal Council post-quantum-cryptography roadmap lead); ssd-disclosure (anti-bot interstitial on the listing page again; 4th+ consecutive affected run, though this run's own source_health.py sweep classed the host reachable, so the block is specific to the listing page's content shape, not the whole host).

Entity/relation notes: actor:earth-berberoka (alias Gambling Goblin) registered with typed uses relations to tool:orat, tool:alphaagent and tool:downpro. malware:etherrat (existing entity) is referenced, not re-registered, on the Teams helpdesk-impersonation entry, Microsoft's own article never uses the "EtherRAT" name (its Defender detection signatures read "EtherRatz"), so the entry's references[] and sourcing_note record this as a mechanistic overlap the entry asserts, not an identity Microsoft itself states.

Deep dive: 2026-09-03/gambling-goblin-earth-berberoka-gov-apache-seo-fraud, selected under criterion 3 (substantive new technical analysis with actionable detection guidance); category other (post-compromise government-web-server implant/SEO-fraud infrastructure abuse, not a classic espionage APT campaign nor any existing rotation category). No deep dive published in the preceding 24 h window at run start.